Wednesday Why: Logins and Sessions

Allen Halsey asked an interesting question a few days ago:

The bash man page says that .bash_profile is executed by login shells. But I log into my desktop using gdm. So I'm confused at what point is .bash_profile executed. Or is it? If it isn't, where should I define environment variables?

The answer to this question lies in the difference between a login and a session. A login occurs when you authenticate to the system in character mode
and a shell is started for you. Each user's shell is defined in /etc/password; here is my record from that file:

chris:x:500:500:Chris Tyler:/home/chris:/bin/bash

Fields in this file are separated by colons (":"), and the seventh field contains the name of the shell that will be executed upon login. This doesn't have to be a shell in the traditional command-interpreter sense; it can be any valid program, and it's not uncommon to use a menu program or a specific application (such as an e-mail program) for the convenience of inexperienced users or to constrain what the user can do. If the user should not be permitted to login at all, the program /sbin/nologin is specified as the shell, which simply prints the message "This account is currently not available" and exits (tip: you can create a custom message in the file /etc/nologin.txt).

The normal value for the login shell field on a Fedora system is /bin/bash, the Bourne-again shell (a nameplay on the Bourne shell, one of the first and most popular Unix shells). Like other shells, bash executes a startup script every time a shell starts (~/.bashrc) and two profile scripts at each login (/etc/profile and one of ~/.bash_profile, ~/.bash_login, or ~/.profile -- Fedora sets up new accounts with ~/.bash_profile by default). Note the difference: if you login once and then start three shells, /etc/profile and ~/.bash_profile will each be executed once, but ~/.bashrc will be executed three times.

A session, on the other hand, is the graphical version of a login. The session is started by the display manager gdm (or, alternatively, kdm or xdm) when the program starts. The session is under the control of a session manager, which starts standard clients (GUI programs), re-starts certain clients if they die, and optionally restarts clients that were open when the last session ended. The GNOME session manager is gnome-session and the KDE session manager is ksmserver, which is started by the startkde script. This process completely ignores the seventh field in /etc/passwd, and the login profiles are not executed.

But it's not quite that simple: the session manager is started by the script /etc/X11/xdm/Xsession, and in Fedora, that script does not execute the session manager directly. When starting a GNOME session, it executes this command:

exec -l $SHELL -c "$SSH_AGENT $DBUS_LAUNCH gnome-session"

And for a KDE session it executes:

exec -l $SHELL -c "$SSH_AGENT $DBUS_LAUNCH startkde"

The environment variables used in these commands are set by the script /etc/X11/xinit/xinitrc-common. Usually, SHELL is /bin/bash, SSH_AGENT is /usr/bin/ssh-agent, and DBUS_LAUNCH is "/usr/bin/dbus-launch --exit-with-session".

Together, this means that bash is run as a login shell and therefore executes /etc/profile and ~/.bash_profile. It then starts ssh_agent, which then starts dbus-launch, which then starts the session manager. This chain ensures that environment variables set by the login profiles, ssh_agent, and dbus-launch programs are properly exported to the programs running within the session.

We can easily test this execution path by adding some code to the end of the ~/.bash_profile:

# display a message to stdout
echo ".bash_profile executed"

# display a message on the GUI display
zenity --info --text ".bash_profile executed"

# set an environment variable
export FDP=".bash_profile executed"

If we now login in character mode, we see these messages:

Last login: Wed Aug 15 12:04:27 2007 from dailypackage.fedorabook.com
.bash_profile executed

(zenity:3689): Gtk-WARNING **: cannot open display:
[chris@localhost ~]$

Notice that the message ".bash_profile executed" from the echo command is displayed correctly, but that zenity can't display its graphical message because there is no X server available. On the other hand, when we login graphically, the zenity dialog shown in the screenshot is displayed, but the output from echo is not visible (note that since there is no window manager running, the zenity window does not have window decorations such as a border, titlebar, or controls). Regardless of how we've logged in, if we check the environment variable FDP, we find that it has been correctly propagated:

$ echo $FDP
.bash_profile executed

So you can safely export environment variables from your .bash_profile in all cases.

However, if the profile needs to interact with the user, it should detect whether it is running in a character-mode or a GUI environment. If in a character-mode environment, the command tty will return success; if in a GUI environment, the DISPLAY variable should be set. To ask the user a question, you could use code such as this:

if [ "$DISPLAY" ]
then

if zenity --question --text "Do you want to foo?"
then

ANSWER="Y"

else

ANSWER="N" # Default if zenity can't connect to display

fi

elif tty --quiet
then

echo -n "Do you want to foo? "
read ANSWER

else

echo "No tty and no GUI!"
ANSWER="N" # Default if we can't ask the user

fi

In addition to the profiles executed at login and the ~/.bashrc script executed when a shell starts, the ~/.bash_logout script is executed when the user logs out. The Fedora default logout script simply clears the character-mode screen, ensuring that no confidential information is left visible.